diff --git a/.github/workflows/auto-close.yml b/.github/workflows/auto-close.yml
index 5206ce4df5dca94e02dc94cf8720ea8b7e27e72e..dfdc561b2d299ff8e6363fa7ebef7994b729ef97 100644
--- a/.github/workflows/auto-close.yml
+++ b/.github/workflows/auto-close.yml
@@ -1,5 +1,7 @@
 name: Auto close
-on: pull_request_target
+on:
+  pull_request_target:
+    types: [opened]
 
 permissions:
   pull-requests: write
diff --git a/.github/workflows/enforce-dependency-review.yml b/.github/workflows/enforce-dependency-review.yml
index bd1797d642e0422f8873f5b09b8bd7248c6f19c9..b57b1f4a1485bfbf01e5bbb655c0aa98e3ac9e69 100644
--- a/.github/workflows/enforce-dependency-review.yml
+++ b/.github/workflows/enforce-dependency-review.yml
@@ -1,5 +1,7 @@
 name: 'Dependency Review'
-on: [pull_request]
+on:
+  pull_request:
+    types: [opened, edited, reopened, synchronize]
 
 jobs:
   enforce-dependency-review:
diff --git a/.github/workflows/test-integration-17.yml b/.github/workflows/test-integration-17.yml
index 96683ee0d045d1f26eb016f119c56d5bef2ccf70..2ae38c7de827f890bc1428fa0ad670a47230578e 100644
--- a/.github/workflows/test-integration-17.yml
+++ b/.github/workflows/test-integration-17.yml
@@ -1,13 +1,17 @@
 name: Integration@node 17
 on:
   pull_request:
+    types: [opened, edited, reopened, synchronize]
   push:
     branches-ignore:
       - 'gh-pages'
+      - 'dependabot/**'
 
 jobs:
   test-integration-17:
     runs-on: ubuntu-latest
+    env:
+      PAT_EXISTS: ${{ secrets.GH_PAT != '' }}
 
     services:
       redis:
@@ -31,7 +35,14 @@ jobs:
         env:
           NPM_CONFIG_ENGINE_STRICT: 'false'
 
-      - name: Integration Tests
+      - name: Integration Tests (with PAT)
+        if: ${{ env.PAT_EXISTS == 'true' }}
+        uses: ./.github/actions/integration-tests
+        with:
+          github-token: '${{ secrets.GH_PAT }}'
+
+      - name: Integration Tests (with workflow token)
+        if: ${{ env.PAT_EXISTS == 'false' }}
         uses: ./.github/actions/integration-tests
         with:
           github-token: '${{ secrets.GITHUB_TOKEN }}'
diff --git a/.github/workflows/test-integration.yml b/.github/workflows/test-integration.yml
index 7052239ce1145c37143991fdc3a32bca8f24e829..1a5d98cfbd5acb5da6cad28ac35a6eeb26a8e612 100644
--- a/.github/workflows/test-integration.yml
+++ b/.github/workflows/test-integration.yml
@@ -1,13 +1,17 @@
 name: Integration
 on:
   pull_request:
+    types: [opened, edited, reopened, synchronize]
   push:
     branches-ignore:
       - 'gh-pages'
+      - 'dependabot/**'
 
 jobs:
   test-integration:
     runs-on: ubuntu-latest
+    env:
+      PAT_EXISTS: ${{ secrets.GH_PAT != '' }}
 
     services:
       redis:
@@ -29,7 +33,14 @@ jobs:
         with:
           node-version: 16
 
-      - name: Integration Tests
+      - name: Integration Tests (with PAT)
+        if: ${{ env.PAT_EXISTS == 'true' }}
+        uses: ./.github/actions/integration-tests
+        with:
+          github-token: '${{ secrets.GH_PAT }}'
+
+      - name: Integration Tests (with workflow token)
+        if: ${{ env.PAT_EXISTS == 'false' }}
         uses: ./.github/actions/integration-tests
         with:
           github-token: '${{ secrets.GITHUB_TOKEN }}'
diff --git a/.github/workflows/test-lint.yml b/.github/workflows/test-lint.yml
index b05c8f8b349a153a3befd9077383b12599ef3b7a..6bbfccc2b9a3c846a8b3686e19f5f650ff0e0b25 100644
--- a/.github/workflows/test-lint.yml
+++ b/.github/workflows/test-lint.yml
@@ -1,9 +1,11 @@
 name: Lint
 on:
   pull_request:
+    types: [opened, edited, reopened, synchronize]
   push:
     branches-ignore:
       - 'gh-pages'
+      - 'dependabot/**'
 
 jobs:
   test-lint:
diff --git a/.github/workflows/test-main-17.yml b/.github/workflows/test-main-17.yml
index daabb51cc12f5dc6dc1ef25ae0c5d90a37ff6938..af7890827bd5f4f5a17598caeb3f2b9d676f0207 100644
--- a/.github/workflows/test-main-17.yml
+++ b/.github/workflows/test-main-17.yml
@@ -1,9 +1,11 @@
 name: Main@node 17
 on:
   pull_request:
+    types: [opened, edited, reopened, synchronize]
   push:
     branches-ignore:
       - 'gh-pages'
+      - 'dependabot/**'
 
 jobs:
   test-main-17:
diff --git a/.github/workflows/test-main.yml b/.github/workflows/test-main.yml
index e57fdc59a0d087db7ecca08d62193d9c9d55d9e9..2e079cd816016b90fdc13eb389114f4daddbbd4c 100644
--- a/.github/workflows/test-main.yml
+++ b/.github/workflows/test-main.yml
@@ -1,9 +1,11 @@
 name: Main
 on:
   pull_request:
+    types: [opened, edited, reopened, synchronize]
   push:
     branches-ignore:
       - 'gh-pages'
+      - 'dependabot/**'
 
 jobs:
   test-main:
diff --git a/.github/workflows/test-package-cli.yml b/.github/workflows/test-package-cli.yml
index 02a128c1efea7b91c5e09033b8d8e30c00dc89c0..2d54b1c0a4f6eb82498c5980a4583362edb4184c 100644
--- a/.github/workflows/test-package-cli.yml
+++ b/.github/workflows/test-package-cli.yml
@@ -1,9 +1,11 @@
 name: Package CLI
 on:
   pull_request:
+    types: [opened, edited, reopened, synchronize]
   push:
     branches-ignore:
       - 'gh-pages'
+      - 'dependabot/**'
 
 # Smoke test (render a badge with the CLI) with only the package
 # dependencies installed.
diff --git a/.github/workflows/test-package-lib.yml b/.github/workflows/test-package-lib.yml
index aa733eb233ee6b8805f57b2075d3a270e69c3c0f..a0d3ec72104cb3d5e434a82f0038f8ccc4d9d3d8 100644
--- a/.github/workflows/test-package-lib.yml
+++ b/.github/workflows/test-package-lib.yml
@@ -1,9 +1,11 @@
 name: Package Library
 on:
   pull_request:
+    types: [opened, edited, reopened, synchronize]
   push:
     branches-ignore:
       - 'gh-pages'
+      - 'dependabot/**'
 
 jobs:
   test-package-lib: